Skills okx-agent-payments-protocol
📦

okx-agent-payments-protocol

v4.2.1 Content revision r1 High Risk 📁 Filesystem access🔑 Env variables⚡ Contains scripts⚙️ External commands🌐 Network access

處理 OKX Agent Payment 流程

付費代理端點通常需要謹慎執行簽署、確認與重播步驟。此技能會引導 Claude、Codex 與 Claude Code 完成 OKX Agent Payments Protocol 流程。

Supports: Claude Codex Code(CC)
Maintain this Skill? Claim it ⚠️ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "okx-agent-payments-protocol" from https://skillstore.io/skills/internet-court-okx-agent-payments-protocol.md and its manifest at https://skillstore.io/api/skills/internet-court-okx-agent-payments-protocol/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Test it

Using "okx-agent-payments-protocol". 我需要存取一個傳回 HTTP 402 的付費天氣端點。

Expected outcome:

  • 顯示所需的網路、代幣、金額、收款方與請求參數。
  • 在檢查錢包狀態或簽署前,要求明確確認。
  • 付款後回報結算結果,並建議檢查餘額。

Using "okx-agent-payments-protocol". 建立一個付款連結,將 0.01 USDT 支付至我的賣方錢包。

Expected outcome:

  • 確認付款連結已建立。
  • 顯示付款識別碼、金額、收款方,以及可用時可分享的連結。
  • 建議在買方付款後檢查狀態。

Using "okx-agent-payments-protocol". 完成最後一個請求後,關閉我目前有效的付款通道。

Expected outcome:

  • 使用已儲存的通道狀態關閉通道。
  • 顯示收取金額、預付餘額、退款金額與鏈上交易參考資訊。

Security Audit

High Risk
v2 • 7/21/2026 Open versioned report

Most static matches are false positives caused by Markdown code formatting, relative documentation links, protocol literals, and security-oriented guidance. Four findings are confirmed because the local-key fallback reads EVM_PRIVATE_KEY from the environment or ~/.onchainos/.env to authorize payment signing. No prompt-injection, credential-exfiltration, or covert network-intent evidence was found in the reviewed material.

9
Files scanned
1,248
Lines analyzed
3
Review items
0
False positives ignored

Confirmed security concerns (1)

High
Environment file access
Reads `EVM_PRIVATE_KEY` (env var or `~/.onchainos/.env`), derives the payer, generates the nonce, co
The workflow directs the local-key fallback to read EVM_PRIVATE_KEY from the environment or a local environment file. This creates credential-exposure and signing risk.
Capability review items (3)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High
Hidden file in home directory
Reads `EVM_PRIVATE_KEY` (env var or `~/.onchainos/.env`), derives the payer, generates the nonce, co
The documented local-key fallback reads a private key from ~/.onchainos/.env. Accessing a wallet credential on the host has material compromise impact if the CLI or environment is unsafe.
High
Generic API/secret keys
Reads `EVM_PRIVATE_KEY` (env var or `~/.onchainos/.env`), derives the payer, generates the nonce, co
The documented local-key fallback reads EVM_PRIVATE_KEY to sign payments. A private key is a high-value credential and its use can authorize financial transactions.
Medium
Hidden file access
Reads `EVM_PRIVATE_KEY` (env var or `~/.onchainos/.env`), derives the payer, generates the nonce, co
The local-key fallback explicitly accesses ~/.onchainos/.env to obtain a wallet credential. This is sensitive host-file access with high impact if exposed.
Audited by: claude View Audit History →
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/internet-court-okx-agent-payments-protocol/audits/2?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/internet-court-okx-agent-payments-protocol/security.svg)](https://skillstore.io/skills/internet-court-okx-agent-payments-protocol?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/internet-court-okx-agent-payments-protocol?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/internet-court-okx-agent-payments-protocol/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/internet-court-okx-agent-payments-protocol.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

internet-court. (2026). okx-agent-payments-protocol security audit report (audit version 2) [Author version 4.2.1]. Skillstore. https://skillstore.io/skills/internet-court-okx-agent-payments-protocol/audits/2

BibTeX citation

@techreport{internet-court-internet-court-okx-agent-payments-protocol-2026, author = {internet-court}, title = {okx-agent-payments-protocol security audit report (audit version 2)}, institution = {Skillstore}, year = {2026}, number = {2}, url = {https://skillstore.io/skills/internet-court-okx-agent-payments-protocol/audits/2}, note = {Author version 4.2.1} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "okx-agent-payments-protocol security audit report (audit version 2)" version: "4.2.1" type: report authors: - name: "internet-court" date-released: "2026-07-21" url: "https://skillstore.io/skills/internet-court-okx-agent-payments-protocol/audits/2" identifiers: - type: other value: "skillstore:internet-court-okx-agent-payments-protocol:audit:2" description: "Skillstore immutable audit report identifier"

Compare variants

2 installable variants

Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.

Why this variant is first

Stronger evidence confidence
internet-court Recommended Current

internet-court-okx-agent-payments-protocol

Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 10
Updated

2026-09-09

okx-okx-agent-payments-protocol

Skillstore Score 38
Evidence Confidence Low
Skillstore usage 7
Updated

2026-09-09

Skillstore Score

Why this score Evidence Confidence: Medium
45
Architecture
100
Maintainability
87
Content
65
Community
91
Spec Compliance

What You Can Build

存取付費代理端點

處理 HTTP 402 回應、顯示付款詳細資料、取得確認、簽署,並重播受保護的請求。

管理付款通道

開啟預付 session、簽發憑證、儲值餘額,並在清楚追蹤狀態的情況下關閉通道。

操作 a2a 付款連結

建立賣方連結、支付買方連結、輪詢狀態,並以淺白語言呈現付款的終止狀態。

Try These Prompts

支付受保護端點
呼叫 <endpoint URL>。如果它傳回付款要求,請顯示 charge 詳細資料,並在付款前等待我的確認。
建立付款連結
建立一個 a2a 付款連結,將 <amount> <symbol> 支付至 <recipient address>,描述為 <description>。
繼續通道工作階段
使用通道 <channel_id> 向 <business URL> 發出另一個請求。追蹤累計金額並顯示通道狀態。
比較付款方案
針對此 HTTP 402 回應,比較可用的 OKX Agent Payments Protocol 選項、推薦其中一項,並等待確認。

Best Practices

  • 簽署前,確認每筆付款的金額、代幣、網路、收款方與請求參數。
  • 可行時,優先使用 TEE 錢包簽署,而非本機私鑰備援方式。
  • 將通道識別碼、託管地址、鏈 ID、存款、累計金額與簽章保留在對話狀態中。

Avoid

  • 顯示必要的確認卡片前,請勿簽署付款。
  • 請勿重複使用過期的簽章或付款挑戰。
  • 若提供簡單的付款結果已足夠,請勿揭露內部協定路由資訊。

Frequently Asked Questions

此技能涵蓋哪些付款流程?
涵蓋 x402 accepts-based 付款、subscription offers、一次性 charge、session channels 與 a2a payment links。
此技能會自行移轉資金嗎?
它會引導執行簽署付款授權的命令。使用者應在簽署前確認付款詳細資料。
它需要 OKX 錢包工作階段嗎?
大多數流程需要有效的錢包工作階段。部分 accepts-based 流程提供本機金鑰備援方式。
它可以使用私鑰嗎?
只有 accepts-based 本機備援方式會使用 EVM_PRIVATE_KEY。較安全的預設方式是 TEE 錢包簽署。
如何處理定期付款?
subscription 流程會簽署有界限的 Permit2 與訂閱條款,然後使用存取證明來存取受保護資源。
對於 a2a 連結,我應驗證哪些資訊?
支付 a2a 付款識別碼前,請透過其他管道驗證賣方、金額、代幣與收款方。

Developer Details

License

MIT

Author version

v4.2.1

Skillstore revision

r1

Ref

3f6e026a3363e0954ede7bef0cfe88d4475de137

Maintenance freshness

7/21/2026

Usage

1 downloads · 0 views